• Home
• Fortinet Exams
• FCP_FMG_AD-7.4 - FCP - FortiManager 7.4 Administrator

FCP_FMG_AD-7.4 Fortinet Practice Test Questions and Exam Dumps

Question 1

Which two of the following features can be managed using FortiManager? (Choose 2.)

A. FortiGate firewall policies
B. FortiSwitch VLANs and ports
C. FortiAP configurations
D. FortiAnalyzer log storage
E. FortiMail mail flow policies

Answer: A, C

Explanation:
FortiManager is a centralized management platform developed by Fortinet. It is specifically designed to manage Fortinet’s security infrastructure, especially FortiGate firewalls and other Fortinet devices like FortiAPs (wireless access points). Its core functionalities include policy and object management, device configuration, centralized updates, and role-based administration.

Option A, FortiGate firewall policies, is one of the primary functions of FortiManager. It allows administrators to create, organize, and push security policies to multiple FortiGate devices. This centralized control helps reduce misconfigurations and simplifies large-scale security policy deployments.

Option C, FortiAP configurations, can also be managed through FortiManager when these access points are managed via FortiGate in what’s called a "FortiLink" or Wi-Fi controller setup. Since FortiManager can push configuration templates and manage profiles related to wireless devices, this falls under its capabilities when integrated with FortiGate.

Option B, FortiSwitch VLANs and ports, is generally managed through FortiLink when the FortiSwitch is connected and controlled via FortiGate. FortiManager does not manage FortiSwitch configurations directly; instead, these configurations are often done through the FortiGate interface, which can be centrally managed, but switch-specific VLAN and port settings are not a direct function of FortiManager.

Option D, FortiAnalyzer log storage, refers to Fortinet's dedicated log analytics and reporting platform. While FortiManager can integrate with FortiAnalyzer to correlate logs with policies, it does not manage log storage. FortiAnalyzer remains the primary solution for that purpose.

Option E, FortiMail mail flow policies, pertains to Fortinet’s email security platform. FortiManager does not handle mail routing or email-specific policy configurations, as those fall under FortiMail's own management and interface.

To summarize, FortiManager is best suited for centralized configuration and policy management of FortiGate and related network security infrastructure like FortiAPs. It does not handle log storage (FortiAnalyzer), email flow (FortiMail), or direct switch management (FortiSwitch). Therefore, the correct answers are A and C.

Question 2

When configuring centralized logging on FortiManager, which two steps are required to ensure that logs are properly collected from FortiGate devices? (Choose 2.)

A. Enable log forwarding on the FortiGate devices
B. Configure the FortiGate device's IP address in FortiManager’s trusted hosts list
C. Set up a local log server in FortiManager
D. Enable SNMP logging on FortiGate devices
E. Install FortiAnalyzer to collect logs from FortiGate devices

Answer: A, B

Explanation:
Centralized logging is essential for managing and monitoring FortiGate devices effectively through FortiManager. In order to ensure that logs are correctly collected, specific configuration steps must be followed both on the FortiGate devices and on FortiManager.

First, enabling log forwarding on the FortiGate devices (Option A) is a fundamental requirement. FortiGate devices do not automatically send logs to FortiManager unless explicitly configured to do so. You need to set up each FortiGate to forward logs to FortiManager by specifying the IP address of FortiManager as the log receiver and configuring the log type, level, and format. Without enabling log forwarding, no logs will be transmitted.

Second, it is essential to configure the FortiGate device’s IP address in FortiManager’s trusted hosts list (Option B). This step ensures that FortiManager recognizes and allows connections from the FortiGate device. FortiManager will not accept log data or management traffic from untrusted sources for security reasons. By adding the FortiGate IP to the trusted hosts list, you establish a secure communication channel between the two systems.

Let’s now consider the incorrect options:

Option C: Set up a local log server in FortiManager is not required for collecting logs from FortiGate devices. FortiManager does have limited log storage capability, but for full logging features, especially for large environments, Fortinet recommends FortiAnalyzer. In this context, setting up a local log server on FortiManager is not a necessary step for basic log collection.

Option D: Enable SNMP logging on FortiGate devices is unrelated to log collection by FortiManager. SNMP is primarily used for network monitoring, status updates, and performance data—not for transferring firewall logs or security event logs. Enabling SNMP traps or polling might be useful for NMS tools but not for FortiManager log collection.

Option E: Install FortiAnalyzer to collect logs from FortiGate devices is not required when using FortiManager for centralized logging. While FortiAnalyzer is a dedicated log management and analytics appliance with more robust reporting and storage features, FortiManager itself can perform logging functions. Hence, installing FortiAnalyzer is an optional enhancement, not a requirement for enabling log collection in FortiManager.

To summarize, the two essential steps for proper log collection in FortiManager are enabling log forwarding on the FortiGate and ensuring that the FortiGate is added to FortiManager’s trusted hosts. These actions establish the necessary trust and communication paths for secure and effective centralized logging.

Question 3

Which two methods can be used to simplify device deployment with FortiManager? (Choose 2.)

A. Configure device templates for FortiGate devices
B. Use the Import Wizard to add FortiGate devices to FortiManager
C. Apply local configuration changes directly on FortiGate devices
D. Use Auto-Discovery to add FortiGate devices to the FortiManager inventory
E. Configure security policies on individual FortiGate devices rather than through FortiManager

Answer: A, B

Explanation:
FortiManager provides a range of tools and automation features to help streamline and standardize the deployment and ongoing management of FortiGate devices. When rolling out FortiGate firewalls, using centralized templates and automation tools reduces manual steps, ensures configuration consistency, and accelerates the setup process.

Option A, Configure device templates for FortiGate devices, is one of the key features that helps simplify device deployment. Templates in FortiManager allow administrators to predefine settings like network interfaces, system parameters, and even policy packages that can be automatically pushed to devices when they come online. This reduces configuration time and helps enforce standardized deployments across multiple firewalls.

Option B, Use the Import Wizard to add FortiGate devices to FortiManager, is another helpful tool that streamlines onboarding. The Import Wizard walks administrators through the process of discovering, importing, and configuring FortiGate devices into the FortiManager inventory. This removes the need to manually create entries and assign initial configurations, making the process more user-friendly and efficient.

Option C, Apply local configuration changes directly on FortiGate devices, actually complicates centralized deployment. If local changes are made directly on the firewall, these changes can conflict with the FortiManager’s configuration database. FortiManager uses a concept called "policy and object synchronization," and any out-of-band changes (those made outside of FortiManager) may lead to inconsistencies, requiring a manual resolution process.

Option D, Use Auto-Discovery to add FortiGate devices to the FortiManager inventory, is misleading. FortiManager does not support a fully automated "Auto-Discovery" feature in the sense that it automatically scans and detects new FortiGates. Devices must be registered or authorized manually or imported through the Import Wizard or bulk operations. There are automated elements involved, but not full zero-touch device discovery.

Option E, Configure security policies on individual FortiGate devices rather than through FortiManager, goes against the purpose of FortiManager. This approach not only undermines centralized management but can also lead to configuration drift, inconsistent policy enforcement, and extra administrative overhead.

Thus, the two correct answers—those that actually simplify and standardize the deployment of FortiGate devices using FortiManager—are A and B.

Question 4

Which two of the following are key benefits of using FortiManager for FortiGate management? (Choose 2.)

A. Simplifies management of multiple FortiGate devices using templates and policy objects
B. Allows direct configuration of FortiGate devices via CLI only
C. Supports centralized policy management for multiple FortiGate devices
D. Provides real-time traffic analysis and reporting across all FortiGate devices
E. Enables centralized firmware upgrades for FortiGate devices

Answer: A, C

Explanation:
FortiManager is designed to simplify and centralize the management of Fortinet security devices, primarily FortiGate firewalls. Its architecture and features enable administrators to efficiently control large-scale security deployments by using centralized configuration, policy management, and automation.

One of the key advantages of FortiManager is its ability to simplify the management of multiple FortiGate devices using templates and policy objects (Option A). With FortiManager, administrators can define policy packages, objects, and templates that can be reused across many FortiGate devices. This centralized approach drastically reduces configuration errors, ensures policy consistency across sites, and saves time by avoiding redundant manual setup on each device.

Another critical benefit is centralized policy management (Option C). FortiManager lets administrators create and enforce security policies across multiple FortiGate devices from a single interface. This includes both device-level policies and global policies that span regions or business units. With centralized control, it becomes easier to audit, maintain, and roll out changes to firewall rules across distributed environments.

Let’s now examine the incorrect choices:

Option B: Allows direct configuration of FortiGate devices via CLI only is incorrect because while FortiManager supports CLI scripts and advanced command execution, it also provides a robust graphical user interface (GUI) and tools to manage FortiGate configurations. It does not limit administrators to CLI-only interactions.

Option D: Provides real-time traffic analysis and reporting across all FortiGate devices is not a core function of FortiManager. Real-time traffic monitoring and detailed analytics are features primarily offered by FortiAnalyzer, a separate Fortinet product. FortiManager is focused on configuration, policy, and device management—not log analysis or traffic reporting.

Option E: Enables centralized firmware upgrades for FortiGate devices might seem correct at first, but it's only partially true. While FortiManager can assist with device firmware management to some extent, its firmware upgrade capabilities are not its main function, and they are less comprehensive compared to its configuration and policy management features. Also, some organizations still prefer to use FortiGate's built-in firmware tools or FortiDeploy/FortiCloud for full lifecycle upgrade management.

In summary, FortiManager stands out for simplifying the management of multiple FortiGate firewalls by using reusable templates and centralized policy control. These features enhance operational efficiency, security consistency, and scalability across network environments.

Question 5

Which two steps are involved in configuring a FortiGate device to use FortiManager for centralized configuration management? (Choose 2.)

A. Configure FortiManager as the default route for the FortiGate device
B. Add the FortiGate device to FortiManager’s device inventory
C. Set up a secure tunnel between the FortiGate device and FortiManager
D. Enable the FortiManager interface on the FortiGate device for management
E. Use the FortiGate device’s external IP address for FortiManager communication

Answer: B, D

Explanation:
To enable centralized management of FortiGate devices through FortiManager, a few specific steps are necessary both on the FortiGate and FortiManager side. These steps ensure that the FortiManager can discover, authenticate, and communicate securely with the FortiGate appliance.

Option B, Add the FortiGate device to FortiManager’s device inventory, is one of the required steps. In FortiManager, administrators must add the FortiGate device to the device manager inventory so that configuration management, firmware updates, and policy packages can be applied. This process can be done manually or using tools like the Import Wizard.

Option D, Enable the FortiManager interface on the FortiGate device for management, is also a required step. On the FortiGate, you need to allow FortiManager access by enabling centralized management. This is typically done via the command line using the config system central-management command, where you set the FortiManager IP address and allow the management connection. Without enabling this option, FortiGate will not accept management commands from FortiManager.

Option A, Configure FortiManager as the default route for the FortiGate device, is incorrect. FortiManager does not act as a default gateway or route traffic for the FortiGate device. The FortiGate device must simply be able to reach the FortiManager over the network. Routing should be configured appropriately, but FortiManager is not the default route.

Option C, Set up a secure tunnel between the FortiGate device and FortiManager, is misleading. While communication between FortiGate and FortiManager is secured using Fortinet’s proprietary protocols (FGFM – FortiGate-FortiManager protocol), administrators do not manually "set up a tunnel" like in a VPN. Instead, the connection is established automatically when the FortiGate is authorized and managed by FortiManager.

Option E, Use the FortiGate device’s external IP address for FortiManager communication, is only sometimes applicable. Whether you use the external or internal IP depends on the network design. The key point is that FortiManager must be able to reach the FortiGate over an IP that has access to the required management port (typically TCP 541). There is no requirement to use the external IP specifically.

In conclusion, the two necessary and correct steps involved in configuring a FortiGate device for FortiManager are B and D.

Question 6

Which two FortiManager features are used to optimize the deployment and management of FortiGate devices in large-scale environments? (Choose 2.)

A. Centralized policy and object management
B. Multi-device firmware upgrade
C. Automated backup and restore of FortiGate configurations
D. Single Sign-On (SSO) for multiple device access
E. Automated discovery of FortiGate devices through SNMP

Answer: A, B

Explanation:
In large-scale environments, managing multiple FortiGate devices efficiently becomes a complex task that requires centralized oversight, consistency in policy enforcement, and ease of deployment. FortiManager addresses these needs through a variety of features, two of the most important being centralized policy/object management and multi-device firmware upgrades.

Option A: Centralized policy and object management is one of the core features of FortiManager and a major reason it is widely adopted in enterprise-scale environments. It allows administrators to define firewall rules, security policies, and objects (like IP addresses, services, user groups) centrally and apply them across multiple FortiGate devices. This not only ensures consistency in security configurations but also dramatically reduces the time and complexity required to manage device policies individually. In large networks, this centralization is crucial to avoid configuration drift and human errors.

Option B: Multi-device firmware upgrade is another key feature that supports efficient lifecycle management. FortiManager can push firmware updates to multiple FortiGate devices simultaneously or in stages. This is especially important in large deployments where managing firmware version consistency across hundreds or thousands of devices would otherwise be a time-consuming and error-prone manual task. It streamlines the update process and ensures that devices stay secure with the latest patches and features.

Let’s now examine why the remaining options are incorrect or less relevant:

Option C: Automated backup and restore of FortiGate configurations is a valuable feature, but it is more of a reliability or recovery function than a deployment or optimization feature. While backups are important, they do not directly affect deployment scalability or operational streamlining in the same way centralized management and firmware upgrades do.

Option D: Single Sign-On (SSO) for multiple device access refers more to identity and access management than deployment efficiency. FortiManager does allow for role-based access control (RBAC) and admin account management, but SSO is not a core optimization feature for device deployment and management. Also, SSO is generally handled through integrations with external identity providers, not as a primary function of FortiManager itself.

Option E: Automated discovery of FortiGate devices through SNMP is not a typical method used in FortiManager. Devices are more commonly discovered and authorized via direct communication or through importing configurations. SNMP is more often associated with monitoring tools than deployment tools. FortiManager does support certain automatic discovery methods, but not specifically via SNMP.

In conclusion, the two features that most directly support optimized deployment and large-scale FortiGate management in FortiManager are centralized policy and object management and multi-device firmware upgrades. These capabilities reduce administrative overhead, ensure consistent security posture, and streamline device provisioning across complex enterprise networks.

Question 7

When performing a firmware upgrade for a FortiGate device through FortiManager, which two steps should be taken to ensure a successful upgrade? (Choose 2.)

A. Backup the FortiGate device configuration before upgrading
B. Disable centralized management on the FortiGate device during the upgrade
C. Install the new firmware package directly on the FortiGate device via CLI
D. Verify that the firmware version on FortiManager matches the version to be applied
E. Ensure that the FortiGate device is in the same administrative domain as FortiManager

Answer: A, D

Explanation:
When upgrading the firmware of a FortiGate device using FortiManager, it is essential to follow proper procedures to ensure the upgrade goes smoothly and no critical data or access is lost.

Option A, Backup the FortiGate device configuration before upgrading, is a best practice and a highly recommended step. A firmware upgrade may change or reset configuration elements. Having a backup allows you to restore the device to a known good state if the upgrade fails or introduces unexpected behavior. FortiManager offers the option to automatically back up the configuration prior to firmware deployment.

Option D, Verify that the firmware version on FortiManager matches the version to be applied, is also correct. FortiManager maintains a repository of firmware images, and the administrator must ensure the correct version is available and selected for deployment. Using the wrong version could lead to device incompatibility or functional issues. This check prevents applying an unintended or incompatible firmware build to the FortiGate device.

Option B, Disable centralized management on the FortiGate device during the upgrade, is not necessary and actually counterproductive. Disabling centralized management would prevent FortiManager from communicating with and managing the FortiGate device during the process. Firmware upgrades through FortiManager require active communication.

Option C, Install the new firmware package directly on the FortiGate device via CLI, contradicts the use of FortiManager. While CLI upgrades are valid in general, they bypass FortiManager’s centralized tools and features. If the upgrade is being done via FortiManager, it should use its firmware management features rather than direct CLI commands on the FortiGate.

Option E, Ensure that the FortiGate device is in the same administrative domain as FortiManager, is not technically accurate. Devices in different administrative domains (ADOMs) can be managed separately within FortiManager, and upgrades can still be performed as long as the FortiGate is correctly associated with a valid ADOM. There's no requirement for the FortiGate and FortiManager to be in the "same" ADOM unless your FortiManager is enforcing a particular ADOM structure for isolation or policy purposes.

Therefore, to ensure a successful and reliable firmware upgrade, the administrator should always backup the configuration before the upgrade (A) and verify the correct firmware version in FortiManager’s repository (D).

Question 8

Which two of the following options are considered best practices for managing FortiGate policies using FortiManager? (Choose 2.)

A. Use policy packages for different use cases (e.g., VPN, Web Filtering)
B. Directly configure policies on FortiGate devices to avoid syncing delays
C. Use versioning to keep track of policy changes and rollbacks
D. Merge all policies into a single package to simplify management
E. Apply policies from FortiManager to multiple devices at once

Answer: A, C

Explanation:
Effective management of FortiGate policies through FortiManager requires structured and scalable approaches, especially in enterprise environments where multiple policies must be maintained across several devices. Best practices are built around flexibility, accountability, and control, and two of the most important recommendations are the use of dedicated policy packages and the implementation of versioning.

Option A: Use policy packages for different use cases (e.g., VPN, Web Filtering) is a well-recognized best practice. This method allows for the creation of modular and reusable sets of policies tailored to specific functions or services. For example, one package may contain only VPN rules, another may handle web filtering, and a third could manage intrusion prevention settings. This separation of concerns improves clarity, reduces the risk of misconfiguration, and allows for targeted updates without impacting unrelated services.

Option C: Use versioning to keep track of policy changes and rollbacks is another best practice that supports accountability and change management. FortiManager provides the ability to track changes to policies and configurations via revisions. This version control is essential in environments where multiple administrators may be modifying policy sets. It allows administrators to quickly revert to a known-good configuration if something breaks, and it enables auditing and review of changes over time.

Now let’s analyze the incorrect options:

Option B: Directly configure policies on FortiGate devices to avoid syncing delays is counter to the whole purpose of FortiManager. FortiManager is designed to be the central management point, and any changes made directly on a FortiGate device create configuration drift. This leads to synchronization conflicts and undermines centralized management. A best practice is to always perform policy configuration and updates through FortiManager, not on the individual FortiGate units.

Option D: Merge all policies into a single package to simplify management may seem like it simplifies things on the surface, but it can actually create confusion and increase the likelihood of errors. When all policies are lumped together, it's harder to track what rule applies to which service, and maintaining or updating specific areas of the configuration becomes more time-consuming. Modular policy packages aligned with use cases or departments are a much more scalable and clear approach.

Option E: Apply policies from FortiManager to multiple devices at once is technically possible and sometimes used in controlled environments where devices share identical roles and configurations. However, it’s not always considered a best practice unless those devices are truly identical in function. Applying policies across multiple devices without considering contextual differences (e.g., location, interface naming, or address objects) can lead to incorrect behavior and misapplied rules. Best practice recommends using device mappings and policy assignments tailored to the specific context of each device.

In conclusion, the two options that align best with FortiManager management best practices are creating use case-specific policy packages and utilizing versioning to monitor changes. These methods improve clarity, support scalability, and reduce the risks associated with misconfigurations and unauthorized changes.

Question 9

What are two key advantages of using FortiManager's centralized logging and reporting capabilities? (Choose 2.)

A. Collects logs from FortiGate devices to FortiAnalyzer for advanced analytics
B. Allows logs to be stored locally on each FortiGate device
C. Simplifies security auditing and compliance by storing logs in a central location
D. Automatically filters out logs from untrusted sources
E. Provides detailed reporting on traffic flow and policy enforcement

Answer: C, E

Explanation:
FortiManager's centralized logging and reporting capabilities are designed to improve the visibility, manageability, and compliance of security operations across multiple Fortinet devices, especially FortiGate firewalls. While FortiAnalyzer is the primary Fortinet product dedicated to logging and analytics, FortiManager integrates closely with it and benefits from its advanced capabilities when deployed together.

Option C, Simplifies security auditing and compliance by storing logs in a central location, is correct. Centralized log storage is critical for effective security management. It ensures all logs are aggregated in one place, making it easier to run audits, generate compliance reports, and investigate incidents. It eliminates the need to manually retrieve logs from individual devices and supports long-term storage, which is essential for regulatory compliance.

Option E, Provides detailed reporting on traffic flow and policy enforcement, is also correct. Centralized logging enables administrators to generate comprehensive reports that show how traffic is handled across the network, which policies are being enforced, and whether any security violations are occurring. These reports can be customized to highlight specific data such as application usage, threat detection, or bandwidth consumption, aiding in operational decision-making.

Option A, Collects logs from FortiGate devices to FortiAnalyzer for advanced analytics, is technically a feature of FortiAnalyzer, not FortiManager. While FortiManager and FortiAnalyzer can work in tandem, FortiManager itself does not perform advanced analytics. Therefore, while it integrates with FortiAnalyzer, A is not a correct standalone advantage of FortiManager.

Option B, Allows logs to be stored locally on each FortiGate device, is not a centralized logging feature. In fact, the opposite is true: centralized logging is used to avoid relying on local device storage, which is often limited and not suitable for long-term retention or large-scale auditing.

Option D, Automatically filters out logs from untrusted sources, is not a standard feature of FortiManager’s centralized logging system. Logs are collected based on configured policies, and while filtering can be applied, there is no automatic exclusion solely based on the “trust” level of the source unless specifically configured.

In summary, the key advantages of FortiManager’s centralized logging and reporting are best reflected in C and E, which highlight the benefits of compliance, security visibility, and operational efficiency.

Question 10

When using FortiManager to manage a FortiGate device, which two methods can be employed to apply changes to FortiGate device configurations? (Choose 2.)

A. Direct push of configuration changes via FortiManager
B. Manual changes to the device via FortiGate CLI and then syncing with FortiManager
C. Use of the FortiGate web interface to make changes and then push to FortiManager
D. Configuration changes are automatically saved and applied without requiring user interaction
E. Use of FortiManager templates to automate configuration for multiple devices

Answer: A, E

Explanation:
When managing FortiGate devices through FortiManager, administrators have a few supported and recommended ways to apply and distribute configuration changes. The process is centered around centralization, automation, and control. The two valid and efficient methods of applying configurations to FortiGate devices using FortiManager are directly pushing changes and using templates.

Option A: Direct push of configuration changes via FortiManager is a core functionality of FortiManager. Once configuration changes are made within the FortiManager interface—such as modifying policies, address objects, or settings—an administrator can directly push those changes to the managed FortiGate devices. This is a controlled operation, allowing the administrator to verify, preview, and then deploy changes only when ready. This method ensures that all managed devices stay consistent with the centralized configuration and avoids configuration drift.

Option E: Use of FortiManager templates to automate configuration for multiple devices is another major feature and best practice. Templates can include system settings, interface configurations, routing setups, and more. These templates can be mapped to multiple devices, making it easier to roll out consistent configurations across similar FortiGate appliances. It greatly simplifies the process of mass deployment and reduces the chance of human error.

Now, let’s examine why the other options are incorrect:

Option B: Manual changes to the device via FortiGate CLI and then syncing with FortiManager is not a recommended approach. Although it is technically possible to make manual changes directly on the FortiGate device, this causes configuration drift from what FortiManager has on record. FortiManager will detect these out-of-band changes during a revision check and flag a conflict. While it is possible to fetch the configuration from the FortiGate back into FortiManager, this defeats the purpose of centralized management and can lead to confusion or even overwriting of settings during the next deployment. Therefore, this is not a preferred method.

Option C: Use of the FortiGate web interface to make changes and then push to FortiManager is also not valid. The FortiGate GUI does not have the capability to push settings to FortiManager. It operates as a standalone interface when not managed. Any changes made here are not automatically synchronized back to FortiManager and can lead to conflicts. Best practice dictates that all configuration changes be made through FortiManager when a device is under its control.

Option D: Configuration changes are automatically saved and applied without requiring user interaction is incorrect. FortiManager does not automatically push or apply changes to FortiGate devices without administrative action. All configuration changes must be manually installed (pushed) by an administrator. This intentional design ensures control, accountability, and the opportunity to review configurations before deployment.

In summary, the two valid methods of applying changes through FortiManager are directly pushing updates and using configuration templates for automation. These methods align with centralized, controlled, and scalable network administration practices.